Merge pull request 'feat(branch-protection): enable actions bot whitelist in sync_rulesets' (#222) from feat/actions-bot-branch-protection into dev

feat(branch-protection): enable actions bot whitelist in sync_rulesets (#222)

.mokogitea/workflows/issue-branch.yml

@@ -5,7 +5,7 @@
 # FILE INFORMATION
 # DEFGROUP: Gitea.Workflow
 # INGROUP: moko-platform.Automation
-# VERSION: 09.15.00
+# VERSION: 09.17.00
 # BRIEF: Auto-create feature branch when an issue is opened
 
 name: "Universal: Issue Branch"

CHANGELOG.md

@@ -12,12 +12,12 @@ BRIEF: Release changelog
 # Changelog
 ## [Unreleased]
 
+## [09.17.00] --- 2026-05-30
+
+## [09.16.00] --- 2026-05-30
+
 ## [09.15.00] --- 2026-05-30
 
 ## [09.14.00] --- 2026-05-30
 
 ## [09.13.00] --- 2026-05-30
-
-## [09.12.00] --- 2026-05-30
-
-## [09.11.00] --- 2026-05-30

README.md

@@ -6,7 +6,7 @@ DEFGROUP: MokoStandards.Root
 INGROUP: MokoStandards
 REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
 PATH: /README.md
-VERSION: 09.15.00
+VERSION: 09.17.00
 BRIEF: Project overview and documentation
 -->
 

cli/branch_rename.php

@@ -9,7 +9,7 @@
  * INGROUP: moko-platform
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
  * PATH: /cli/branch_rename.php
- * VERSION: 09.15.00
+ * VERSION: 09.17.00
  * BRIEF: Rename a git branch via Gitea API (create new, update PR, delete old)
  *
  * Usage:

cli/bulk_workflow_push.php

@@ -12,7 +12,7 @@
  * INGROUP: moko-platform
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
  * PATH: /cli/bulk_workflow_push.php
- * VERSION: 09.15.00
+ * VERSION: 09.17.00
  * BRIEF: Push a workflow file to all governed repos via the Gitea Contents API
  */
 

cli/bulk_workflow_trigger.php

@@ -11,7 +11,7 @@
  * INGROUP: moko-platform
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
  * PATH: /cli/bulk_workflow_trigger.php
- * VERSION: 09.15.00
+ * VERSION: 09.17.00
  * BRIEF: Trigger a workflow across multiple repos at once
  */
 

cli/client_dashboard.php

@@ -12,7 +12,7 @@
  * INGROUP: moko-platform
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
  * PATH: /cli/client_dashboard.php
- * VERSION: 09.15.00
+ * VERSION: 09.17.00
  * BRIEF: Generate unified client dashboard HTML
  */
 

cli/client_inventory.php

@@ -11,7 +11,7 @@
  * INGROUP: moko-platform
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
  * PATH: /cli/client_inventory.php
- * VERSION: 09.15.00
+ * VERSION: 09.17.00
  * BRIEF: Discover and list all client-waas repos with their server configuration status
  */
 

cli/client_provision.php

@@ -12,7 +12,7 @@
  * INGROUP: moko-platform
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
  * PATH: /cli/client_provision.php
- * VERSION: 09.15.00
+ * VERSION: 09.17.00
  * BRIEF: Provision a new client environment end-to-end
  */
 

cli/grafana_dashboard.php

@@ -12,7 +12,7 @@
  * INGROUP: moko-platform
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
  * PATH: /cli/grafana_dashboard.php
- * VERSION: 09.15.00
+ * VERSION: 09.17.00
  * BRIEF: Manage Grafana dashboards via API
  */
 

cli/joomla_build.php

@@ -9,7 +9,7 @@
  * INGROUP: moko-platform
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
  * PATH: /cli/joomla_build.php
- * VERSION: 09.15.00
+ * VERSION: 09.17.00
  * BRIEF: Build a Joomla extension ZIP from manifest — all types supported
  * NOTE: Called by pre-release and auto-release workflows.
  *

cli/manifest_read.php

@@ -9,7 +9,7 @@
  * INGROUP: moko-platform
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
  * PATH: /cli/manifest_read.php
- * VERSION: 09.15.00
+ * VERSION: 09.17.00
  * BRIEF: Parse .manifest.xml and output requested field(s) for CI consumption
  *
  * Usage:

cli/release_cascade.php

@@ -9,7 +9,7 @@
  * INGROUP: moko-platform
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
  * PATH: /cli/release_cascade.php
- * VERSION: 09.15.00
+ * VERSION: 09.17.00
  * BRIEF: DEPRECATED — cascade behavior removed. Each release stream is independent.
  */
 

cli/release_publish.php

@@ -9,7 +9,7 @@
  * INGROUP: moko-platform
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
  * PATH: /cli/release_publish.php
- * VERSION: 09.15.00
+ * VERSION: 09.17.00
  * BRIEF: Publish a release and create copies for all lesser stability streams.
  *
  * When a release is published at a given stability, copies are created for all

cli/scaffold_client.php

@@ -11,7 +11,7 @@
  * INGROUP: moko-platform
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
  * PATH: /cli/scaffold_client.php
- * VERSION: 09.15.00
+ * VERSION: 09.17.00
  * BRIEF: Scaffold a new client-waas repo from Template-Client-WaaS with pre-configured settings
  */
 

cli/sync_rulesets.php

@@ -56,34 +56,38 @@ $PROTECTIONS = [
 		'name'   => 'MAIN — protect default branch',
 		'branch' => 'main',
 		'rules'  => [
-			'required_reviews'  => 1,
-			'dismiss_stale'     => true,
-			'enforce_admins'    => true,
-			'block_on_rejected' => true,
+			'required_reviews'       => 1,
+			'dismiss_stale'          => true,
+			'enforce_admins'         => true,
+			'block_on_rejected'      => true,
+			'whitelist_actions_user' => true,
 		],
 	],
 	[
 		'name'   => 'VERSION — immutable snapshots',
 		'branch' => 'version/*',
 		'rules'  => [
-			'required_reviews' => 0,
-			'enforce_admins'   => true,
+			'required_reviews'       => 0,
+			'enforce_admins'         => true,
+			'whitelist_actions_user' => true,
 		],
 	],
 	[
 		'name'   => 'DEV — prevent branch deletion',
 		'branch' => 'dev/*',
 		'rules'  => [
-			'required_reviews' => 0,
-			'enforce_admins'   => true,
+			'required_reviews'       => 0,
+			'enforce_admins'         => true,
+			'whitelist_actions_user' => true,
 		],
 	],
 	[
 		'name'   => 'RC — prevent branch deletion',
 		'branch' => 'rc/*',
 		'rules'  => [
-			'required_reviews' => 0,
-			'enforce_admins'   => true,
+			'required_reviews'       => 0,
+			'enforce_admins'         => true,
+			'whitelist_actions_user' => true,
 		],
 	],
 ];

cli/updates_xml_sync.php

@@ -9,7 +9,7 @@
  * INGROUP: moko-platform
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
  * PATH: /cli/updates_xml_sync.php
- * VERSION: 09.15.00
+ * VERSION: 09.17.00
  * BRIEF: Sync updates.xml to target branches via Gitea API
  * NOTE: Called by pre-release and auto-release workflows after updates.xml
  *       is modified on the current branch. Pushes the file to other branches

cli/version_auto_bump.php

@@ -9,7 +9,7 @@
  * INGROUP: moko-platform
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
  * PATH: /cli/version_auto_bump.php
- * VERSION: 09.15.00
+ * VERSION: 09.17.00
  * BRIEF: Auto patch-bump, set stability suffix, and commit — single CLI replacing inline workflow bash
  *
  * Usage:

cli/version_check.php

@@ -9,7 +9,7 @@
  * INGROUP: moko-platform
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
  * PATH: /cli/version_check.php
- * VERSION: 09.15.00
+ * VERSION: 09.17.00
  * BRIEF: Validate version consistency across README, manifests, and sub-packages
  *
  * Usage:

cli/wiki_sync.php

@@ -9,7 +9,7 @@
  * INGROUP: moko-platform
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
  * PATH: /cli/wiki_sync.php
- * VERSION: 09.15.00
+ * VERSION: 09.17.00
  * BRIEF: Sync select wiki pages from moko-platform to all template repos
  */
 

deploy/backup-before-deploy.php

@@ -11,7 +11,7 @@
  * INGROUP: MokoStandards
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
  * PATH: /deploy/backup-before-deploy.php
- * VERSION: 09.15.00
+ * VERSION: 09.17.00
  * BRIEF: Snapshot Joomla directories before deployment for rollback capability
  */
 

deploy/deploy-dolibarr.php

@@ -11,7 +11,7 @@
  * INGROUP: MokoStandards
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
  * PATH: /deploy/deploy-dolibarr.php
- * VERSION: 09.15.00
+ * VERSION: 09.17.00
  * BRIEF: Deploy Dolibarr module files to a remote server via SFTP/rsync
  */
 

deploy/health-check.php

@@ -11,7 +11,7 @@
  * INGROUP: MokoStandards
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
  * PATH: /deploy/health-check.php
- * VERSION: 09.15.00
+ * VERSION: 09.17.00
  * BRIEF: Post-deploy health check — verify a Joomla site is responding correctly
  */
 

deploy/rollback-joomla.php

@@ -11,7 +11,7 @@
  * INGROUP: MokoStandards
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
  * PATH: /deploy/rollback-joomla.php
- * VERSION: 09.15.00
+ * VERSION: 09.17.00
  * BRIEF: Rollback a Joomla deployment by restoring from a pre-deploy snapshot
  */
 

deploy/sync-joomla.php

@@ -11,7 +11,7 @@
  * INGROUP: MokoStandards
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
  * PATH: /deploy/sync-joomla.php
- * VERSION: 09.15.00
+ * VERSION: 09.17.00
  * BRIEF: Sync Joomla site directories between two servers via rsync over SSH
  */
 

lib/Enterprise/MokoGiteaAdapter.php

@@ -373,17 +373,20 @@ class MokoGiteaAdapter implements GitPlatformAdapter
     public function setBranchProtection(string $org, string $repo, string $branch, array $rules): array
     {
         // Gitea uses a flat branch protection API
+        $whitelistActions = $rules['whitelist_actions_user'] ?? false;
         $protection = [
-            'branch_name'                     => $branch,
-            'enable_push'                     => true,
-            'enable_push_whitelist'            => false,
-            'enable_merge_whitelist'           => false,
-            'enable_status_check'             => $rules['required_status_checks'] ?? false,
-            'enable_approvals_whitelist'       => false,
-            'required_approvals'              => $rules['required_reviews'] ?? 0,
-            'dismiss_stale_approvals'         => $rules['dismiss_stale'] ?? false,
-            'block_on_rejected_reviews'       => $rules['block_on_rejected'] ?? true,
-            'block_on_outdated_branch'        => $rules['block_on_outdated'] ?? false,
+            'branch_name'                       => $branch,
+            'enable_push'                       => true,
+            'enable_push_whitelist'              => $whitelistActions,
+            'push_whitelist_actions_user'        => $whitelistActions,
+            'enable_merge_whitelist'             => false,
+            'merge_whitelist_actions_user'       => $whitelistActions,
+            'enable_status_check'               => $rules['required_status_checks'] ?? false,
+            'enable_approvals_whitelist'         => false,
+            'required_approvals'                => $rules['required_reviews'] ?? 0,
+            'dismiss_stale_approvals'           => $rules['dismiss_stale'] ?? false,
+            'block_on_rejected_reviews'         => $rules['block_on_rejected'] ?? true,
+            'block_on_outdated_branch'          => $rules['block_on_outdated'] ?? false,
             'block_on_official_review_requests' => false,
         ];
 

tests/Unit/VersionBumpTest.php

@@ -63,7 +63,7 @@ class VersionBumpTest extends TestCase
     {
         file_put_contents(
             "{$this->tmpDir}/README.md",
-            "<!-- VERSION: 09.15.00 -->\nSome content\n"
+            "<!-- VERSION: 09.17.00 -->\nSome content\n"
         );
 
         $this->execute();

tests/Unit/VersionReadTest.php

@@ -34,7 +34,7 @@ class VersionReadTest extends TestCase
     {
         file_put_contents(
             "{$this->tmpDir}/README.md",
-            "# Test\n<!-- VERSION: 09.15.00 -->\n"
+            "# Test\n<!-- VERSION: 09.17.00 -->\n"
         );
 
         $this->assertSame('02.03.04', trim($this->runScript()));
@@ -68,7 +68,7 @@ class VersionReadTest extends TestCase
     {
         file_put_contents(
             "{$this->tmpDir}/README.md",
-            "<!-- VERSION: 09.15.00 -->\n"
+            "<!-- VERSION: 09.17.00 -->\n"
         );
         mkdir("{$this->tmpDir}/src", 0755, true);
         file_put_contents(

validate/check_file_integrity.php

@@ -12,7 +12,7 @@
  * INGROUP: MokoStandards
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
  * PATH: /validate/check_file_integrity.php
- * VERSION: 09.15.00
+ * VERSION: 09.17.00
  * BRIEF: Compare deployed files on a remote server against the local repository to detect drift
  */